The devplatform-jscodeshift-plugin npm package version 35.4.1 is a malicious package masquerading as a legitimate plugin. Upon requiring the package, it reconstructs Cloudflare Workers hostnames from fragmented strings and uses a DNS-TXT fallback channel to download a platform-specific binary. This binary is saved to temporary directories, given executable permissions, and executed detached from the main process. The dropped artifacts impersonate telemetry or .NET diagnostics tools and respect environment variables intended to disable telemetry to avoid detection. The package contains no legitimate plugin functionality and appears to be a name-squatting lure designed solely to drop and execute a remote payload.